Oracle Flaw Drains $9 Million From Hedera's Largest Lender, With $5.25 Million Bridged to Ethereum

Bonzo Lend, the largest decentralized lender on the Hedera network, lost approximately 9.05 million dollars after an attacker exploited a verification flaw in a third-party Supra oracle contract, CoinDesk reported. The mechanism was price manipulation. The attacker deposited 250 SAUCE tokens, worth only a few dollars, then submitted a manipulated price update that inflated the token's value by roughly twelve orders of magnitude. Against that fictitious collateral they borrowed about 6.6 million dollars in USD Coin (USDC) and 34.5 million Wrapped HBAR.

The root cause was cryptographic, not economic. Bonzo said the Supra verifier approved the malicious submission because both the signature point and the referenced committee public key resolved to zero, so the signature check returned a valid result on an input that should have failed. Supra has acknowledged the issue and deployed a fix to the verifier contract on Hedera mainnet. Hedera's total value locked fell by nearly 40 percent in 24 hours and Bonzo's by 77 percent, and the attacker bridged more than 5.25 million dollars to Ethereum, which complicates recovery.

The incident is one of a steady series of smaller thefts catalogued by Rekt News, whose recent list includes losses at BonkDAO, Summer Finance, SecondFi, Secret Network, and an Aztec bridge. The common pattern across the larger events is not a new class of exploit but the repeated failure to validate a single trusted input, the price feed, before funds move.